{"api_version":"1","generated_at":"2026-07-23T13:35:14+00:00","cve":"CVE-2008-3849","urls":{"html":"https://cve.report/CVE-2008-3849","api":"https://cve.report/api/cve/CVE-2008-3849.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2008-3849","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-3849"},"summary":{"title":"CVE-2008-3849","description":"Cross-site scripting (XSS) vulnerability in the calendar controller in Civic Website Manager before 1.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, probably involving (1) month, (2) day, and (3) year fields.","state":"PUBLISHED","assigner":"mitre","published_at":"2008-08-27 23:41:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.securityfocus.com/bid/30833","name":"http://www.securityfocus.com/bid/30833","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"Civic Website Manager Multiple Cross-Site Scripting Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://secunia.com/advisories/31641","name":"http://secunia.com/advisories/31641","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Quick Poll \"id\" SQL Injection Vulnerability - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/44673","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/44673","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/31609","name":"http://secunia.com/advisories/31609","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Civic Website Manager Calendar Control Cross-Site Scripting - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://sourceforge.net/project/shownotes.php?group_id=234663&release_id=621954","name":"http://sourceforge.net/project/shownotes.php?group_id=234663&release_id=621954","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Civic Website Manager download | SourceForge.net","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-3849","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-3849","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2008","cve_id":"3849","vulnerable":"1","versionEndIncluding":"1.0","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"civic-cms","cpe5":"civic-cms","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T09:53:00.367Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"31609","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/31609"},{"name":"31641","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/31641"},{"name":"30833","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/30833"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://sourceforge.net/project/shownotes.php?group_id=234663&release_id=621954"},{"name":"civic-website-calendar-xss(44673)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/44673"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-08-26T00:00:00.000Z","descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) vulnerability in the calendar controller in Civic Website Manager before 1.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, probably involving (1) month, (2) day, and (3) year fields."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-07T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"31609","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/31609"},{"name":"31641","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/31641"},{"name":"30833","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/30833"},{"tags":["x_refsource_CONFIRM"],"url":"http://sourceforge.net/project/shownotes.php?group_id=234663&release_id=621954"},{"name":"civic-website-calendar-xss(44673)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/44673"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2008-3849","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site scripting (XSS) vulnerability in the calendar controller in Civic Website Manager before 1.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, probably involving (1) month, (2) day, and (3) year fields."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"31609","refsource":"SECUNIA","url":"http://secunia.com/advisories/31609"},{"name":"31641","refsource":"SECUNIA","url":"http://secunia.com/advisories/31641"},{"name":"30833","refsource":"BID","url":"http://www.securityfocus.com/bid/30833"},{"name":"http://sourceforge.net/project/shownotes.php?group_id=234663&release_id=621954","refsource":"CONFIRM","url":"http://sourceforge.net/project/shownotes.php?group_id=234663&release_id=621954"},{"name":"civic-website-calendar-xss(44673)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/44673"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2008-3849","datePublished":"2008-08-27T23:00:00.000Z","dateReserved":"2008-08-27T00:00:00.000Z","dateUpdated":"2024-08-07T09:53:00.367Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2008-08-27 23:41:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:civic-cms:civic-cms:*:*:*:*:*:*:*:*","versionEndIncluding":"1.0","matchCriteriaId":"0AD70A50-D470-4772-8DE5-496BC86B1153"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2008","CveId":"3849","Ordinal":"1","Title":"CVE-2008-3849","CVE":"CVE-2008-3849","Year":"2008"},"notes":[{"CveYear":"2008","CveId":"3849","Ordinal":"1","NoteData":"Cross-site scripting (XSS) vulnerability in the calendar controller in Civic Website Manager before 1.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, probably involving (1) month, (2) day, and (3) year fields.","Type":"Description","Title":"CVE-2008-3849"},{"CveYear":"2008","CveId":"3849","Ordinal":"2","NoteData":"2008-08-27","Type":"Other","Title":"Published"},{"CveYear":"2008","CveId":"3849","Ordinal":"3","NoteData":"2017-08-07","Type":"Other","Title":"Modified"}]}}}